Knowledge Management

How to find the search string by using search id/ref/base search ?

pravinvram
Engager

Below is the sample dashboard xml where i can see the tags of search id , ref , base search .. but i need to get hold of the full query which are used in these references ?
Any help to find the same will be much appreciated

0 Karma

woodcock
Esteemed Legend

Check out David Paper's excellent dashboard that analyzes searches:
https://splunk-usergroups.slack.com/files/U04JY7N3G/FFGJD40AJ/extended_search_reporting.xml

0 Karma

niketn
Legend

@pravinvram , there are two types of search you are looking at:
1) Post Process Searches:
Where there is a Base Search which run to return a statistical output (using transforming command like stats, timechart etc.). The base search is given some ID for example id="myBaseSearch1" and the ID is then used by a post-process search to reuse the result from the Base Search and prepare a different statistical output. The Post-Process search refers to base search using syntax like base="myBaseSearch1". This process can be cascaded to perform recursive post-processing.
So you can search for search IDs within the dashboard to see where they have been used for Post-Processing.

2) Refer a Saved Search in Dashboard Query: Here you can add reference to a saved search in your dashboard using ref="<yourSavedSearchName>". For each Saved Search name you can navigate to Report view and find out respective Report Name.

Please refer to attached Splunk Documentation links and try out the examples to understand them better. You can also check out Splunk Dashboard Examples app to check out and learn from actual implementation of these concepts.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...